Ivanti Zero-Day Chain: Three Flaws, Unauthenticated Root Access

WarBrief Live | November 6, 2026 | Cybersecurity

The Ivanti Connect Secure zero-day chain links three flaws – an authentication bypass, a code-execution bug and a privilege escalation – to give an unauthenticated attacker root access on a fully patched VPN appliance. All three flaws now have fixes, but the first US federal patching deadline passed on November 2, 2026, and the attack is built to leave almost no trace. This is what investigators confirmed, what remains unverified, and what organisations running the appliance should do now.

What is the Ivanti Connect Secure zero-day chain?

Ivanti Connect Secure (ICS) is the SSL VPN appliance many organisations place at the edge of their network to give staff remote access. It answers login requests from the open internet, which makes it a high-value target: compromise the gateway and you are inside the perimeter without touching a single workstation.

The chain is a sequence of three vulnerabilities that only delivers its full effect together. Security firm Volexity discovered the activity in the first week of October 2026 while investigating suspected malicious activity at a network security monitoring customer. The affected appliance was running version 22.8R2.4, Build 19097 – the latest release at the time. Working with Ivanti, Volexity reconstructed the attack from core dumps and system memory, not from logs, because the attacker had deleted them.

Volexity tracks the intruder as UTA0576, a previously unknown actor. It has not publicly attributed the actor to any known group or state. What is confirmed is the timeline: exploitation began on October 3, 2026, ten days before Ivanti shipped the first fix, and 26 days before a complete fix existed. Ivanti says exploitation affected “a limited number of customers” when the three flaws are chained. No victim count has been published.

Ivanti disclosed the first flaw, CVE-2026-104935, on October 13, 2026. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of October 16. On October 29, Ivanti updated its security advisory with fixes for the two remaining flaws. CISA added both to the catalog on October 30. The chain is the latest entry in a long pattern: Rapid7 notes that Connect Secure has a history of zero-day exploitation, including in 2024 and 2025.

How does the Ivanti zero-day chain work?

The attack has three stages, each exploiting a different weakness. On its own, none of them gives an attacker root. Together, they hand over the appliance.

Stage 1 – authentication bypass (CVE-2026-104935). Connect Secure serves its login page from /dana-na/auth/url_default/welcome.cgi, which must be reachable without logging in. Requests to that page can also carry an X-DSCGI-PATH header naming a different CGI script. According to Volexity, the URL decided whether a request was allowed, but the header decided where it was routed. An attacker could send a request to the public login page with the header pointing at a protected script – the upload handler wu.cgi – and that script would run without authentication.

Stage 2 – code execution (CVE-2026-104935). The wu.cgi handler wrote an uploaded file to /home/runtime/tmp/<MD5(filename)> and only then checked whether it was a valid ZIP, deleting it if not. That left a short window in which an attacker-supplied script sat on disk. The attacker uploaded a Perl script with a .zip name and, in parallel, sent requests that used the same header trick to execute the temporary file before it was deleted. The resulting code ran as the cgi-server user – inside the appliance, but not yet root.

Stage 3 – privilege escalation (CVE-2026-111357). To reach root, the attacker patched an Ivanti library in that process’s memory and edited the shared DSCache configuration so that a root maintenance task, dsinvoked, launched Perl. The third flaw, CVE-2026-118527, covers predictable filenames that let an attacker upload controlled content to a known location on disk; Ivanti’s updated advisory identifies it as an additional component of the chain. The result is unauthenticated root-level code execution on a device that was fully patched when the attack began.

Notably, the attacker deployed no backdoor and no web shell. Commands travelled inside the exploit’s own HTTPS requests and the output returned in the same response, so the actor re-exploited the device for every command it ran. That design is part of why the intrusion is so hard to spot: there is no persistent malware to find.

What did UTA0576 do after getting in?

Once it had root, the actor went after credentials. Volexity reports that it stole VPN and Active Directory credentials, deployed a custom Python tool to search Active Directory for Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys, and ran password spraying against the victim’s directory. It also ran a renamed traffic-capture tool, dsstatmond, from a hidden directory, and searched the network from the appliance itself.

Then it covered its tracks. Volexity found that the payload removed recent entries from the Ivanti debug log and the Linux audit log, deleted its own scripts and temporary results, and restored the in-memory library patch and the DSCache entry to their legitimate state. Because the compromise lived in memory only, Ivanti’s Integrity Checker Tool – which inspects the disk – would have had nothing to report. Rapid7’s guidance is blunt on this point: a clean integrity result does not rule out compromise. Preserve memory and logs before rebooting or resetting where feasible, and rotate potentially exposed credentials.

One indicator defenders can hunt for: requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header. That header is the trick behind the bypass. Volexity has also published indicators of compromise, including the exploitation IP address 108.165.147.64, and YARA rules for the request-header evidence and the in-memory privilege escalation payload.

By the numbers: what is confirmed and what is reported

Figures with a named source are confirmed by the vendor, CISA, the investigating firm or the cited tracker. The ransomware-gateway framing in this article is analysis of the access this chain creates, not a confirmed ransomware incident: as of November 6, 2026, no ransomware deployment has been publicly tied to UTA0576.

Timeline: from first exploitation to the federal deadline

• October 3, 2026: UTA0576 begins exploiting a fully patched Connect Secure 22.8R2.4 appliance.
• October 5, 2026: Volexity begins its investigation at a network security monitoring customer.
• October 13, 2026: Volexity publishes its report. Ivanti patches CVE-2026-104935 in versions 25.1.1.2, 22.8R2.5 and 25.1.3.0/25.1.3.1. CISA adds the CVE to its Known Exploited Vulnerabilities catalog, with a federal deadline of October 16.
• October 15, 2026: MITRE publishes the CVE record for CVE-2026-111357, scoring it 7.0 – lower than Ivanti’s 8.8.
• October 29, 2026: Ivanti updates its advisory with fixes for CVE-2026-111357 and CVE-2026-118527 in versions 25.1.1.3 and 22.8R2.6.
• October 30, 2026: CISA adds both new CVEs to the catalog. Federal deadlines: November 2 for CVE-2026-111357 (with forensic triage required) and November 13 for CVE-2026-118527.
• November 2, 2026: The federal deadline for CVE-2026-111357 passes. Rapid7 publishes consolidated response guidance, warning that a clean integrity scan proves nothing.
• November 5, 2026: Coverage of the chain as a ransomware gateway spreads as record third-quarter ransomware figures circulate.

Why the Ivanti chain is a ransomware gateway

VPN appliances are prime ransomware targets for structural reasons. They must be reachable from the internet by design, so they are discoverable by automated scanning. Once compromised, they sit in a trusted position inside the network, bypassing perimeter firewalls. They see authentication tokens, session cookies and credentials passing through. And network appliances are often overlooked in routine patching cycles and security monitoring, giving attackers extended dwell time.

The Ivanti chain delivers exactly that foothold, and it lands in a record ransomware quarter. Comparitech counted 2,627 claimed ransomware attacks in the third quarter of 2026 – the highest quarterly total it has recorded, up 29 percent on the second quarter (2,030 attacks) and 61 percent on the same period in 2025 (1,636). Of the total, 247 were confirmed by the organisations involved – 138 businesses, 53 government entities, 36 healthcare providers and 20 educational institutions – while 2,380 remain unconfirmed claims posted on gang leak sites. The most prolific groups were Qilin, with 357 claims, and The Gentlemen, with 342.

The speed matters as much as the volume. Rapid7’s third-quarter threat report found attackers exploiting newly disclosed high-severity vulnerabilities within an average of three days of public disclosure, with 71 percent of tracked exploitation occurring within the first week. Of the 43 newly exploited vulnerabilities it tracked, 79 percent required no authentication or user interaction – the profile of an ideal ransomware entry point.

This is a familiar playbook. WarBrief has covered the same pattern before: ransomware gangs exploiting the Palo Alto GlobalProtect flaw, and the AI-assisted intrusion frameworks now running ransomware operations. The Ivanti chain is more dangerous than either in one respect: the entry point was a fully patched device, so the usual advice – “just patch” – was not enough for the first 26 days. To be precise about what is proven: no public evidence ties UTA0576 itself to a named ransomware deployment. What is confirmed is credential theft and Active Directory reconnaissance – the standard first stage of a ransomware intrusion, and the reason the chain is being treated as a gateway rather than an isolated VPN bug.

What the Ivanti zero-day chain means for US/UK/EU readers

For US readers, the federal deadlines tell the story: October 16 for the first flaw, November 2 for the privilege escalation, November 13 for the file-upload flaw. Federal agencies were ordered to patch on those dates. Private-sector organisations face no such order, but the same exposure – and the same forensic homework if they were running vulnerable versions in early October.

For UK and EU readers, the risk is identical. The flaws do not respect borders, and CISA’s catalog is a US list describing a global product. Any organisation in Britain or the EU running Connect Secure faced the same 26-day window with no complete fix, and the same blind spot afterwards: a clean integrity scan does not prove the appliance was never touched.

For employees, the practical effects are mundane but real. If your employer runs Ivanti VPN, expect emergency maintenance windows and possible forced password resets while IT teams apply the October 29 fixes and check for compromise. Multi-factor authentication, on its own, does not stop this attack – the chain bypasses authentication entirely, so it never asks for a second factor.

For businesses, the lesson is about process, not just patching. Emergency updates outside normal cycles, memory and log preservation before any reboot, credential rotation for everything the appliance stored, and forensic triage where CISA requires it. In a quarter when ransomware claims hit a record, the cost of treating a VPN appliance as “just infrastructure” keeps rising.

What security researchers and Ivanti disagree on

The two sides do not dispute the facts of the chain, but they assess its severity and its detectability differently. On scoring, Ivanti rates CVE-2026-111357 at 8.8, assessing low attack complexity and changed scope; the CVE record and the National Vulnerability Database rate it 7.0, using high attack complexity and unchanged scope. The disagreement matters because scores drive patching priority – and in this case both scores still land in the range that demands emergency action.

On scope, Ivanti says exploitation affected “a limited number of customers”. That may be accurate, but the true count is hard to establish: the attack deletes its own evidence and evades the vendor’s integrity check, so an unknown number of appliances could have been probed or compromised without any surviving log. Volexity’s investigation began with a single customer; nothing in the public record establishes how many others were hit.

On detection, Ivanti’s advisory tells customers to run the Integrity Checker Tool regularly. Volexity and Rapid7 say a clean result proves nothing, because the compromise lives in memory and the tool inspects the disk. Their advice is to hunt with the published indicators – the welcome.cgi requests carrying the X-DSCGI-PATH header, the file artifacts Volexity listed, and the exploitation IP – and to treat any suspicious appliance as forensic evidence, not as a clean bill of health.

What to watch next in the Ivanti zero-day chain

November 13, 2026, is the next hard date: the CISA federal deadline for CVE-2026-118527. Watch whether Ivanti or CISA publish a victim count or new indicators after that deadline passes, and whether UTA0576 resurfaces or copycat exploitation surges against appliances that were never upgraded from the October 13 fixes – versions 25.1.1.2 and 22.8R2.5 remain exposed to the two newer flaws.

The longer question is whether ransomware groups adopt the chain as an entry point. The access it creates – unauthenticated root on the perimeter device, harvested directory credentials, no forensic footprint – is precisely what ransomware operators buy and sell access for. WarBrief’s intelligence hub will carry updates if a named ransomware operation is linked to the chain, and our explainer on how ransomware-as-a-service operations work sets out why that linkage matters. Until then, the honest status is: a proven gateway, a record ransomware quarter, and no confirmed deployment – yet.

Frequently asked questions

What is CVE-2026-104935?
It is the authentication bypass and remote code execution flaw at the front of the Ivanti Connect Secure chain, rated 8.6 on the CVSS scale. It let an unauthenticated attacker run commands on a vulnerable appliance by abusing the X-DSCGI-PATH header on the public login page. Ivanti patched it on October 13, 2026, in versions 25.1.1.2, 22.8R2.5 and 25.1.3.0/25.1.3.1, and CISA added it to its Known Exploited Vulnerabilities catalog the same day.

Which Ivanti Connect Secure versions are affected?
For CVE-2026-111357 and CVE-2026-118527, versions 25.1.1.2 and prior and 22.8R2.5 and prior are affected; the fixes are 25.1.1.3 and 22.8R2.6. For CVE-2026-104935, versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior are affected; the fixes are 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5. Versions 22.7.x and lower are not affected by CVE-2026-104935, and 25.1.3.0 and later on ISA4500, ISA6500 and ISA8500 appliances are unaffected by the two newer flaws.

How do I know if my Ivanti appliance was compromised?
A clean Integrity Checker Tool result does not rule it out, because the attack runs in memory and deletes logs. Check requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, look for selective deletion in the Ivanti debug log and the Linux audit log, and use Volexity’s published indicators. Preserve memory and logs before rebooting or resetting, and rotate credentials the appliance stored.

Is the Ivanti zero-day chain linked to ransomware?
No ransomware deployment has been publicly tied to the actor tracked as UTA0576. The chain creates the access ransomware operators need – unauthenticated root on the network perimeter plus harvested Active Directory credentials – and it arrived during a record quarter, with Comparitech counting 2,627 claimed ransomware attacks in Q3 2026. The “gateway” description is analysis of that access, not a confirmed incident.

What should organisations do now?
Upgrade to 25.1.1.3 or 22.8R2.6 (or later) on an emergency basis outside normal patching cycles – the October 13 fixes alone do not cover the two newer flaws. Then hunt with Volexity’s indicators, preserve memory and logs, and rotate exposed credentials. If compromise is suspected, follow Ivanti’s recovery steps and treat it as an incident, not a patch job.

Sources

• Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
• Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
• Ivanti: Security Advisory – Ivanti Connect Secure (CVE-2026-104935)
• QUE.com: Ivanti Connect Secure Zero-Day Chain Becomes Ransomware Gateway
• Comparitech: Ransomware roundup: Q3 2026 stats on attacks, ransoms, and active gangs